From e3d9f9afacc0709b9e15244a15ac64c4ab444520 Mon Sep 17 00:00:00 2001 From: Desiree Beck Date: Wed, 6 Nov 2019 18:46:58 -0500 Subject: [PATCH 1/2] add new behavior --- credential-access/README.md | 1 + credential-access/credentials-in-web-browsers.md | 11 +++++++++++ 2 files changed, 12 insertions(+) create mode 100644 credential-access/credentials-in-web-browsers.md diff --git a/credential-access/README.md b/credential-access/README.md index e3641cb..50d3104 100644 --- a/credential-access/README.md +++ b/credential-access/README.md @@ -11,6 +11,7 @@ Behaviors to obtain credential access, allowing it or its underlying threat acto * **Credential Dumping** [T1003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credential-dump.md) * **Credentials in Files** [T1081](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-files.md) * **Credentials in Registry** [T1214](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-registry.md) +* **Credentials in Web Browsers** [T1503](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-web-browsers.md) * **Hooking** [E1179](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md) * **Input Capture** [T1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md) * **LLMNR/NBT-NS Poisoning** [T1171](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/LLMNR-poison.md) diff --git a/credential-access/credentials-in-web-browsers.md b/credential-access/credentials-in-web-browsers.md new file mode 100644 index 0000000..bbc9d65 --- /dev/null +++ b/credential-access/credentials-in-web-browsers.md @@ -0,0 +1,11 @@ +||| +|---------|------------------------| +|**ID**|**T1503**| +|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)| +|**Related ATT&CK Technique(s)**|[Credentials in Web Browsers](https://attack.mitre.org/techniques/T1503/)| + +Credentials in Web Browsers +=========================== +Malware may acquire credentials from web browsers by reading files specific to the target browser. + +**See ATT&CK:** [**Credentials in Web Browsers**](https://attack.mitre.org/techniques/T1503/). \ No newline at end of file From bdbefee41faef58d58f43f4a2c4fffce935dbb28 Mon Sep 17 00:00:00 2001 From: Desiree Beck Date: Fri, 8 Nov 2019 10:08:18 -0500 Subject: [PATCH 2/2] typos --- command-and-control/domain-name-generate.md | 2 +- credential-access/hooking.md | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/command-and-control/domain-name-generate.md b/command-and-control/domain-name-generate.md index 93a6251..a64d7fd 100644 --- a/command-and-control/domain-name-generate.md +++ b/command-and-control/domain-name-generate.md @@ -8,7 +8,7 @@ Domain Name Generation ====================== Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1) -The subsequently defined ATT&CK technique [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/) is oriented toward an adversary perspective (although its examples include malware) is related to this MBC behavior. +The subsequently defined ATT&CK technique [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior. Malware Examples ---------------- diff --git a/credential-access/hooking.md b/credential-access/hooking.md index cb63807..fbaf561 100644 --- a/credential-access/hooking.md +++ b/credential-access/hooking.md @@ -17,6 +17,9 @@ Methods ------- * **Patch MmGetPhysicalMemoryRanges**: Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1) * **Hook memory mapping APIs**: Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1) +* **Hook procedures**: Intercepts and executes designated code in response to events such as messages, keystrokes, and moust inputs. +* **Import Address Hooking (IAT) Hooking**: uses modifications to a process's IAT where pointers to imported API functions are stored. +* **Inline Hooking**: overwrites the first bytes in an API function to redirect code flow. Malware Examples ----------------